OpenClaw privacy notice

1. Scope and roles

This notice applies to OpenClaw trials and paid services supplied by 8Examples Inc. It supplements our website privacy policy. For account, billing, support, and infrastructure information, 8Examples generally determines the purposes of processing. For personal information you direct OpenClaw to process for your business, you are responsible for deciding the lawful purpose and authority, and 8Examples acts as a service provider to operate the worker, subject to applicable law.

2. Information OpenClaw may process

• identity, contact, account, subscription, domain, mailbox, and phone information;
• prompts, messages, conversations, outputs, feedback, files, images, audio, and task history;
• credentials, tokens, permissions, and configuration for services you connect;
• email, calendar entries, contacts, customer records, documents, websites, and other connected-system content;
• communications metadata and content for messages, calls, or texts the worker handles;
• technical logs, IP addresses, device, host, model, token usage, errors, uptime, security, and telemetry information; and
• support communications and information needed to investigate failures or misuse.

3. Purposes

We process this information to provision and operate the worker; follow your instructions; connect requested services; authenticate users; provide email, phone, domain, website, and account functions; monitor reliability, usage, fraud, and security; troubleshoot and support; bill and administer trials; enforce terms; improve service; and meet legal obligations.

4. Your responsibilities for other people’s data

You must have a lawful basis and all necessary authority, consent, and notices before giving OpenClaw personal information about employees, customers, prospects, patients, tenants, children, or anyone else. Do not connect or submit information that the service does not need. You are responsible for access requests, correction, retention, deletion, and other obligations that apply to your own collection and use.

5. AI models and service providers

To perform tasks, information may be sent to AI model providers and to hosting, infrastructure, communications, email, domain, telephone, payment, security, and support providers. Depending on configuration, these providers may be in Canada, the United States, or other countries and may be subject to local law. Third-party services have their own privacy terms. We select and configure providers with reasonable attention to privacy and security, but cannot guarantee their conduct or availability.

6. Human access

Authorized 8Examples personnel may access account information, logs, configuration, or content when reasonably necessary to provision, support, secure, investigate misuse, respond to an incident, comply with law, or act on your request. Access is limited by role and operational need. Do not treat the worker as a confidential channel for information you are not authorized to disclose.

7. Security

We use reasonable safeguards appropriate to the service, which may include access controls, tenant separation, encrypted transport, provider security controls, monitoring, credential handling practices, patching, and limited backups. No AI or internet-connected system is perfectly secure. The more accounts, authority, credentials, or sensitive data you give the worker, the greater the impact of error or compromise. Use least privilege, multi-factor authentication where available, spending and sending limits, approval steps, and independent backups.

8. Retention, cancellation, and deletion

We retain information while needed to provide and secure the service and meet accounting, dispute, and legal obligations. When you cancel or a trial ends, the claw environment and all service backups are destroyed and are not recoverable. Deletion from active systems and rotating backups may take a reasonable operational period. Some providers may retain information under their own schedules. We may retain limited event, billing, consent, fraud, security, and legal records where required or reasonably necessary. A registered domain and its registrar records are not deleted with the claw; the domain remains available for transfer through its registration term.

9. Security incidents

We cannot promise that incidents will never occur. We maintain procedures to investigate and contain suspected incidents. Where a breach involving personal information under our control creates a real risk of significant harm, we will report to the appropriate privacy regulator and notify affected individuals as required by law.

10. Service and promotional messages

We send operational messages needed for setup, credentials, login, trial reminders, conversion, billing, security, support, expiry, and domain transfer. Promotional messages are sent only where permitted by CASL and include required identification and unsubscribe options. Unsubscribing from marketing does not stop essential service or security messages.

11. Access, correction, and contact

Subject to legal exceptions, you may ask to access or correct personal information under our control or withdraw consent where applicable. Contact privacy officer Sean Bennett at [email protected] or 587-288-6116. You may also complain to the Office of the Information and Privacy Commissioner of Alberta or another regulator with jurisdiction.